Skip to content

Commit 3c886a8

Browse files
NathanielRNNathanielRN
authored
GH Action OIDC AWS Creds for GH workflows (#130)
1 parent 1ae69fa commit 3c886a8

8 files changed

+46
-59
lines changed

‎.github/collector/docker-compose.yml

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@ services:
44
image: amazon/aws-otel-collector:latest
55
command: --config /config/collector-config.yml
66
environment:
7-
- AWS_ROLE_ARN
8-
- AWS_WEB_IDENTITY_TOKEN_FILE
7+
- AWS_ACCESS_KEY_ID
8+
- AWS_SECRET_ACCESS_KEY
9+
- AWS_SESSION_TOKEN
910
volumes:
1011
- .:/config
1112
- /tmp/awscreds:/tmp/awscreds
@@ -17,8 +18,9 @@ services:
1718
environment:
1819
- INSTANCE_ID
1920
- LISTEN_ADDRESS
20-
- AWS_ROLE_ARN
21-
- AWS_WEB_IDENTITY_TOKEN_FILE
21+
- AWS_ACCESS_KEY_ID
22+
- AWS_SECRET_ACCESS_KEY
23+
- AWS_SESSION_TOKEN
2224
- OTEL_RESOURCE_ATTRIBUTES=service.name=aws-otel-integ-test
2325
- OTEL_EXPORTER_OTLP_ENDPOINT=http://otel:4317
2426
- AWS_REGION=us-west-2
@@ -37,8 +39,9 @@ services:
3739
- otel
3840
- app
3941
environment:
40-
- AWS_ROLE_ARN
41-
- AWS_WEB_IDENTITY_TOKEN_FILE
42+
- AWS_ACCESS_KEY_ID
43+
- AWS_SECRET_ACCESS_KEY
44+
- AWS_SESSION_TOKEN
4245
- AWS_REGION=us-west-2
4346
volumes:
4447
- /tmp/awscreds:/tmp/awscreds

‎.github/workflows/docker-build-corretto-slim.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ on:
88

99
env:
1010
AWS_DEFAULT_REGION: us-east-1
11-
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1211

1312
permissions:
1413
id-token: write
@@ -23,11 +22,10 @@ jobs:
2322

2423
- run: sleep 5 # there's still a race condition for now
2524
- name: Configure AWS Credentials
26-
run: |
27-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
28-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
29-
30-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
28+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
3129
- name: Login to ECR
3230
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3331

‎.github/workflows/docker-build-smoke-tests-fake-backend.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ on:
1010

1111
env:
1212
AWS_DEFAULT_REGION: us-east-1
13-
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1413

1514
permissions:
1615
id-token: write
@@ -28,11 +27,10 @@ jobs:
2827

2928
- run: sleep 5 # there's still a race condition for now
3029
- name: Configure AWS Credentials
31-
run: |
32-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
33-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
34-
35-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
30+
uses: aws-actions/configure-aws-credentials@v1
31+
with:
32+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
33+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
3634
- name: Login to ECR
3735
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3836

‎.github/workflows/main-build.yml

Lines changed: 16 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ on:
55

66
env:
77
AWS_DEFAULT_REGION: us-east-1
8-
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
98

109
permissions:
1110
id-token: write
@@ -25,11 +24,10 @@ jobs:
2524

2625
- run: sleep 5 # there's still a race condition for now
2726
- name: Configure AWS Credentials
28-
run: |
29-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31-
32-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
27+
uses: aws-actions/configure-aws-credentials@v1
28+
with:
29+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
3331
- name: Login to ECR
3432
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3533

@@ -69,11 +67,10 @@ jobs:
6967

7068
- run: sleep 5 # there's still a race condition for now
7169
- name: Configure AWS Credentials
72-
run: |
73-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
74-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
75-
76-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
70+
uses: aws-actions/configure-aws-credentials@v1
71+
with:
72+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
73+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
7774
- name: Login to ECR
7875
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
7976

@@ -100,11 +97,10 @@ jobs:
10097

10198
- run: sleep 5 # there's still a race condition for now
10299
- name: Configure AWS Credentials
103-
run: |
104-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
105-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
106-
107-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
100+
uses: aws-actions/configure-aws-credentials@v1
101+
with:
102+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
103+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
108104
- name: Login to ECR
109105
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
110106

@@ -131,11 +127,10 @@ jobs:
131127

132128
- run: sleep 5 # there's still a race condition for now
133129
- name: Configure AWS Credentials
134-
run: |
135-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
136-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
137-
138-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
130+
uses: aws-actions/configure-aws-credentials@v1
131+
with:
132+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
133+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
139134
- name: Login to ECR
140135
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
141136

‎.github/workflows/nightly-upstream-snapshot-build.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ on:
55

66
env:
77
AWS_DEFAULT_REGION: us-east-1
8-
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
98

109
permissions:
1110
id-token: write
@@ -25,11 +24,10 @@ jobs:
2524

2625
- run: sleep 5 # there's still a race condition for now
2726
- name: Configure AWS Credentials
28-
run: |
29-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31-
32-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
27+
uses: aws-actions/configure-aws-credentials@v1
28+
with:
29+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
3331
- name: Login to ECR
3432
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3533

‎.github/workflows/patch-release-build.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ on:
1212

1313
env:
1414
AWS_DEFAULT_REGION: us-east-1
15-
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1615

1716
permissions:
1817
id-token: write
@@ -67,11 +66,10 @@ jobs:
6766

6867
- run: sleep 5 # there's still a race condition for now
6968
- name: Configure AWS Credentials
70-
run: |
71-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
72-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
73-
74-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
69+
uses: aws-actions/configure-aws-credentials@v1
70+
with:
71+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
72+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
7573
- name: Login to ECR
7674
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
7775

‎.github/workflows/release-build.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ on:
77

88
env:
99
AWS_DEFAULT_REGION: us-east-1
10-
AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
1110

1211
permissions:
1312
id-token: write
@@ -25,11 +24,10 @@ jobs:
2524

2625
- run: sleep 5 # there's still a race condition for now
2726
- name: Configure AWS Credentials
28-
run: |
29-
export AWS_ROLE_ARN=${{ secrets.AWS_ASSUME_ROLE_ARN }}
30-
echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
31-
32-
curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
27+
uses: aws-actions/configure-aws-credentials@v1
28+
with:
29+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
30+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
3331
- name: Login to ECR1
3432
run: aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
3533

‎.github/workflows/soak-testing.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ jobs:
3737
runs-on: ubuntu-latest
3838
permissions:
3939
contents: write
40+
id-token: write
4041
issues: write
4142
strategy:
4243
fail-fast: false
@@ -99,8 +100,6 @@ jobs:
99100
- name: Configure AWS Credentials
100101
uses: aws-actions/configure-aws-credentials@v1
101102
with:
102-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
103-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
104103
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
105104
role-duration-seconds: 21600 # 6 Hours
106105
aws-region: ${{ env.AWS_DEFAULT_REGION }}

0 commit comments

Comments
 (0)